IoT Security Threats

IoT devices expand the attack surface of any network. Every connected device — a thermostat, a security camera, an industrial sensor — is a potential entry point for attackers. Understanding the specific threats IoT systems face is the foundation of building secure IoT solutions.

Why IoT Security Is Uniquely Challenging

Traditional computers run operating system security tools — firewalls, antivirus software, automatic patches. Most IoT devices cannot. A soil moisture sensor has no screen, no user interface, and sometimes less memory than a floppy disk from the 1990s. It runs a fixed firmware program and never gets updates. This creates a large population of connected devices that are permanently vulnerable once a flaw is discovered.

Scale of the problem:
- Billions of IoT devices deployed worldwide
- Many devices run unpatched firmware for years
- Many use default or identical factory passwords
- Many connect directly to the internet with minimal firewalling
- Many are physically accessible in public locations

Common IoT Security Threats

1. Default Credential Attacks

Most IoT devices ship with a default username and password — often "admin/admin" or "admin/1234" — printed in the manual or publicly documented online. Many device owners never change these defaults. Attackers run automated scanners across the internet, find devices with unchanged default credentials, and log in instantly.

Real-world impact: The Mirai botnet (2016) compromised over 600,000 IoT devices — cameras, DVRs, routers — by scanning for default credentials. It then used these devices to launch one of the largest distributed denial-of-service (DDoS) attacks in history, taking down major portions of the internet including Twitter, Netflix, and PayPal.

2. Unpatched Firmware Vulnerabilities

Software contains bugs. When a security researcher discovers a vulnerability in a device's firmware, the manufacturer releases a patch. If the device owner does not install the patch, the vulnerability remains open forever. Many IoT devices have no mechanism for automatic updates, and many owners do not know how to update firmware manually.

Example: A security camera manufacturer discovers that a specific URL on its devices allows anyone on the network to view the camera feed without a password. They release a patch. Three years later, 40% of those cameras are still running the vulnerable firmware because no one updated them.

3. Insecure Communication (No Encryption)

Devices that transmit data without encryption expose that data to anyone who can intercept the signal. On a home Wi-Fi network, an attacker who joins the network can capture all unencrypted traffic. On a public or industrial network, unencrypted sensor data can be intercepted, read, or modified.

This threat is called a man-in-the-middle (MITM) attack. An attacker positions themselves between a device and its server, intercepts messages, and can either read them or alter them — for example, changing a sensor reading to prevent a safety alarm from triggering.

WITHOUT ENCRYPTION:
Device --> [Attacker reads/modifies data] --> Server

WITH ENCRYPTION (TLS):
Device --> [Encrypted, unreadable to attacker] --> Server

4. Physical Attacks

IoT devices often operate in publicly accessible or unmonitored locations — parking garages, utility poles, fields, building exteriors. A physically accessible device can be tampered with, cloned, replaced with a malicious device, or used to extract stored credentials by connecting directly to its circuit board.

Example: An attacker walks up to a smart parking meter, attaches a small device to the USB port on its exposed circuit board, extracts the device's private encryption key, and uses it to impersonate that device on the network.

5. Side-Channel Attacks

Even a properly encrypted device leaks information through its physical behavior — power consumption patterns, electromagnetic emissions, or timing of operations. A sophisticated attacker measures these physical signals and uses them to reconstruct secret cryptographic keys. This class of attacks bypasses the encryption without breaking it mathematically.

6. Insecure APIs

IoT devices connect to cloud APIs. If those APIs lack proper authentication, rate limiting, or input validation, attackers can query the API to extract data, issue unauthorized commands, or crash the service. Many consumer IoT platforms have been compromised not through the device itself but through weak API security.

Example: An attacker discovers that a smart lock company's API does not require re-authentication to unlock doors — only a valid account session. By hijacking an active session token, the attacker unlocks any door in the system remotely.

7. Rogue Devices and Network Intrusion

An attacker places an unauthorized device on the same network as legitimate IoT devices. The rogue device listens to network traffic, impersonates legitimate devices, or attempts to pivot deeper into the corporate or home network from the less-protected IoT segment.

This is especially dangerous in factories and hospitals where IT networks and OT (operational technology) networks share the same physical infrastructure. If an attacker compromises an IoT sensor on the building management network, they may reach the corporate IT systems through internal network connections.

8. Denial of Service (DoS) Attacks

An attacker floods an IoT device or its server with so many requests that it stops responding to legitimate traffic. A sensor overwhelmed by junk messages cannot report its readings. A medical device's network gateway flooded by traffic cannot relay patient monitoring data. DoS attacks against safety-critical IoT systems can create dangerous real-world conditions.

9. Supply Chain Attacks

Malicious code can be inserted into an IoT device's firmware before the device reaches the end user — during manufacturing, distribution, or firmware update delivery. A compromised firmware image signed with the manufacturer's legitimate key passes security checks and installs normally, but contains hidden malicious functionality.

10. Ransomware on OT Systems

Industrial IoT systems are increasingly targeted by ransomware attacks. Attackers encrypt the control software of manufacturing plants, water treatment facilities, or hospital systems and demand payment to restore access. Unlike ransomware on office computers, attacks on industrial control systems can halt production lines, contaminate water supplies, or disrupt critical healthcare delivery.

IoT-Specific Attack Vectors Summary

Who Attacks IoT Systems?

IoT attackers range across different motivations and capabilities:

• Script kiddies: Use publicly available tools to scan for default credentials with minimal skill
• Cybercriminals: Build botnets from compromised devices for DDoS-for-hire services, crypto mining, and spam delivery
• Corporate espionage actors: Target industrial systems to steal intellectual property or production data
• Nation-state actors: Target critical infrastructure (power grids, water systems, hospitals) for disruption or espionage
• Hacktivists: Disrupt organizations for political or social reasons

Summary

IoT security threats are diverse and serious. Default credentials, unpatched firmware, unencrypted communications, physical access, insecure APIs, and supply chain compromises all represent real, documented attack paths. The scale of IoT deployments — billions of devices with long lifespans and limited update mechanisms — makes the attack surface enormous. Understanding these threats is the first step toward designing systems that resist them.